A Critical Active Storage Vulnerability in Rails — A specially crafted 'image' uploaded to Rails 7.x or 8.x apps in their default configuration can potentially expose arbitrary files on the server via Active Storage's vips processor. Patched in Rails 7.2.3.2, 8.0.5.1 and 8.1.3.1. You may also need to upgrade libvips. Rails 6.x isn't affected by default.

Rafael França and Rails Core

Rails Experts You Like & Trust, Now Embedded in Your Team 🚀 — Since 2017, companies have trusted FastRuby.io with their most complex Rails upgrades. Now those same senior engineers can scale your team fast: shipping features, fixing bugs, accelerating delivery, and using AI effectively. Let's talk!

FastRuby.io® | Staff Augmentation sponsor

The Inliner is Yielding Benefits for ZJIT — ZJIT, the experimental just-in-time compiler written in Rust, has added inlining capabilities. This post shows how method inlining speeds up block-heavy code such as Array#each. Early microbenchmarks are striking, with up to 35x speed gains in one case.

Max Bernstein

Finding 105 Vulnerabilities in the Ruby Ecosystem — An app security firm turned its scanner on gems with native C extensions. A Nokogiri out-of-bounds read of 17 years' vintage is a particular highlight.

Yu, Thakur, Wu, and Lin (Depthfirst)

Golfing Ruby with Codex: From 250 Bytes to 90 — I tell the tale of pushing GPT-5.6 Sol to make a Roman numeral generator smaller, ending at 90 bytes. Along the way, many Ruby features popped out: character literals, endless methods, a 1.% exception trick, and a (not so) novel algorithm from 1976.

Peter Cooper

Why Your Sidekiq Jobs Are Slower Than You Think (And How to Fix It) — N+1s hide inside your jobs. AppSignal ranks your slowest Sidekiq jobs and queries so you fix the right one. (Blog post.)

AppSignal sponsor

Curiosity Reduced the Heap Size by 60% — Agents are often good at diagnosing warnings and errors, but in this case an agent's attempts to ignore a warning led Paweł to a striking memory use saving.

Paweł Pacana

RubyLens: Turn Your Ruby Project into a Galaxy Visualization — A gem that turns a Ruby codebase into a galaxy, in either HTML or video form, built on top of Rubydex which performs the analysis. The site contains a few pre-built examples to enjoy. GitHub repo.

Stan Lo

4 Ways to Steer Your Agents Towards Better Tests — Agents quit when the happy path is green. Undercover keeps them honest with local tools and CI checks for your team.

Undercover CI sponsor

Courrier 1.0: A Gem to Send Emails Without SMTP — Brings the ability to send email through 13 providers and 7 newsletter platforms into a single library. There's also a Rails integration which brings generators and Active Job support.

Rails Designer

🤖 Automating Ruby Tech Debt Audits with Claude Code — Introduces a Claude Code skill (which you can read here) that strings together a variety of tools to produce a scored, one-shot quality report for Ruby projects.

Ernesto Tagwerker